Overview

overview

10

Static

static

10

f9b4f7954f...33.exe

windows7_x64

6

f9b4f7954f...33.exe

windows10_x64

6

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    29-01-2022 17:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9b4f7954f8d3b96b49b79ac3dd8e4489d23eab0cf8e6ee27cfdab1fa54e0233.exe

  • Size

    161KB

  • MD5

    8336d9aeccee3408a4f9fbf4b1a42bac

  • SHA1

    48c1f1155872b108aa4cd6f84340b8e9e55f3c6b

  • SHA256

    f9b4f7954f8d3b96b49b79ac3dd8e4489d23eab0cf8e6ee27cfdab1fa54e0233

  • SHA512

    388b67ccf8e3152ebcc069898a5f18d248b6ed646086292c61dd682b6b602b2db7a79709b9d211288a9470b80d395d30d769e0db66f79674f69d462d26855560

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9b4f7954f8d3b96b49b79ac3dd8e4489d23eab0cf8e6ee27cfdab1fa54e0233.exe
    "C:\Users\Admin\AppData\Local\Temp\f9b4f7954f8d3b96b49b79ac3dd8e4489d23eab0cf8e6ee27cfdab1fa54e0233.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1656

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1656-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1656-55-0x0000000002100000-0x0000000002101000-memory.dmp

    Filesize

    4KB

    Download